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Summary 

This Policy Statement discusses some of the issues raised during the first year of 
auditors' implementation of the PCAOB's Auditing Standard No. 2, An Audit of Internal 
Control Over Financial Reporting Performed in Conjunction witti an Audit of Financial 
Statements ("Auditing Standard No. 2"), which implements Sections 103 and 404 of the 
Sarbanes-Oxley Act of 2002 (the "Act") by establishing a process for auditing public 
companies' internal control over financial reporting in conjunction with an audit of 
financial statements. Many of these issues were raised, among other occasions, at the 
Securities and Exchange Commission's ("SEC" or "Commission") Roundtable on 
Implementation of Internal Control Reporting Provisions, on April 13, 2005. While 
Roundtable participants generally supported the objectives of Section 404, many 
expressed concerns about compliance costs and offered constructive comments about 
how the implementation process can be improved. 

This Policy Statement considers several of the auditing practices observed in the 
first year of implementation that may be ineffective or inefficient means of meeting the 
objectives of Auditing Standard No. 2. It also describes how the PCAOB intends to 
supervise implementation of the standard, from providing additional guidance to make 
audits of internal control more effective and cost-efficient to driving improvements in 
implementation through our inspections of registered public accounting firms. 
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Specifically, this Policy Statement expresses the Board's view that, to properly 
plan and perform an effective audit under Auditing Standard No. 2, auditors should - 

• integrate their audits of internal control with their audits of the client's 
financial statements, so that evidence gathered and tests conducted in 
the context of either audit contribute to completion of both audits, 

• exercise judgment to tailor their audit plans to the risks facing 
individual audit clients, instead of using standardized "checklists" that 
may not reflect an allocation of audit work weighted toward high-risk areas 
(and weighted against unnecessary audit focus in low-risk areas); 

• use a top-down approach that begins with company-level controls, to 
identify for further testing only those accounts and processes that are, in 
fact, relevant to internal control over financial reporting, and use the risk 
assessment required by the standard to eliminate from further 
consideration those accounts that have only a remote likelihood of 
containing a material misstatement; 

• take advantage of the significant flexibility that the standard allows to use 
the work of others; and 

• engage in direct and timely communication with audit clients when 
those clients seek auditors' views on accounting or internal control issues 
before those clients make their own decisions on such issues, implement 
internal control processes under consideration, or finalize financial reports. 

Background 

The Sarbanes-Oxley Act has had a profound effect on the integrity of financial 
reporting in U.S. capital markets. The Act has strengthened and reformed almost every 
aspect of the financial reporting process, from the composition and role of the audit 
committee to preparers' certifications of accuracy, covering the integrity of gatekeepers 
such as analysts, lawyers and auditors in between. Although some of these changes 
have been in place for some time, the participants in the financial reporting process are 
now implementing one of the most challenging - but also one of the most promising - 
provisions of the Act. 
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Section 404 of the Act ainns to strengthen the internal controls that underpin the 
accuracy and reliability of a company's published financial information. That section, 
along with the SEC's implementing rule, requires a public company to annually report its 
assessment of the effectiveness of its internal control over financial reporting. The 
section also requires such a company to provide its auditor's attestation to, and report 
on, the company's assessment. Auditing Standard No. 2 governs the auditor's 
responsibilities under Section 404. 

In the simplest terms, investors can have much more confidence in the reliability 
of a corporate financial statement if corporate management demonstrates that it 
maintains adequate internal control over the preparation of accurate financial 
statements. Companies have been required to have internal control over their 
accounting since the Congress enacted the Foreign Corrupt Practices Act in 1977. 
There is no doubt, however, that the Act's requirement for annual assessments, and 
auditor attestations to those assessments, has led to a renewed emphasis on internal 
control over financial reporting and significant improvements in companies' controls. 

Many of the larger public companies have recently filed their first assessments of 
the effectiveness of their internal controls, as well as the related reports from their 
auditors. There is evidence that the benefits of the internal control requirements are 
already being realized,-' and investors have expressed strong support for the goals of 
Section 404, including the increased transparency that the provision provides.- Section 



- Seventy-nine percent of the 222 financial execufives surveyed by 

Oversight Systems, Inc. reported that their companies have stronger internal controls 
after complying with Section 404. Seventy-four percent said that their companies 
benefited from compliance with Sarbanes-Oxley, and, of those, 33 percent said that 
compliance lessened the risk of financial fraud. See Oversight Systems, Inc., The 2004 
Oversight Systems Financial Executive Report on Sarbanes-Oxley (December 2004). 

' See , e.g. , Remarks of Mark Anson, Chief Investment Officer, California 

Public Employees' Refirement System, Transcript of SEC Roundtable on 
Implementation of Internal Control Reporting Provisions (Apr. 13, 2005) ("Roundtable 
Tr."); Remarks of Ann Yerger, Executive Director, Council of Institutional Investors, 
Roundtable Tr.; Remarks of Damon Silvers, Associate General Counsel, American 
Federation of Labor and Congress of Industrial Organizafions, Roundtable Tr.; Letter 
from Laurie Fiori Hacking, Executive Director, Ohio Public Employees Retirement 
System, to William H. Donaldson, Chairman, SEC (Mar. 1, 2005); see ajso Remarks of 
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404 has, however, proven to be an enormous challenge for those involved in its 
implementation. Companies have found the requirements costly and demanding, and 
many have questioned whether the benefits are worth the cost. 

We take these concerns seriously and are committed to learning from the first 
year's experience implementing Section 404. As part of this effort, on April 13, 2005, 
we participated in the Commission's Roundtable. The Roundtable was an opportunity 
for us and the Commission to hear directly from issuers, auditors, and investors on the 
front line of the Section 404 implementation process. Many participants at the 
Roundtable expressed their support for Section 404's purpose. One of the most 
valuable aspects of the Roundtable, however, has been the constructive criticism 
provided by many of those currently involved in the implementation process. 

The cost of Section 404 compliance was the primary concern raised at the 
Roundtable.- Among other reasons, commenters suggested that costs were too high 
because companies and their auditors did not sufficiently focus their efforts on higher 
risk areas of internal control over financial reporting. In addition, commenters 
expressed the view that auditors did not use the work of others sufficiently or fully 
integrate the audit of internal control with the audit of the financial statements. Some 
Roundtable participants also stated that auditors are often less willing than they were 
previously to provide guidance to clients on accounting issues for fear of compromising 
independence or triggering a material weakness finding. 

At the conclusion of the Roundtable, the Board agreed to take several steps to 
promote an internal control audit process that is both effective and cost-efficient. 
Today, we take the first two of these steps.- First, we are separately publishing a 

Gregory Jonas, Managing Director of Accounting Specialists Group, Moody's Investors 
Service, Roundtable Tr. 

- One survey found that for 217 public companies with average revenues of 
$5 billion, first year Section 404 compliance cost, on average, $4.36 million and 
consumed an average of nearly 27,000 hours. See Financial Executives International, 
FEI Special Survey on SOX Section 404 Implementation (March 2005). 

^ The Board also intends to devote the agenda of the upcoming meeting of 
its Standing Advisory Group, scheduled for June 8 and 9, 2005, to a discussion about 
implementation of Auditing Standard No. 2. 



Case 1:06-cv-00217-JR Document 51 -4 Filed 11/06/2006 Page 5 of 14 



Pt^ A /^ O PCAOB Release 2005-009 

V--/\V^D May 16. 2005 

Public Cbmpany Accounting Overeight Boaid ^ 

POLICY STATEMENT 

series of additional staff questions and answers related to Auditing Standard No. 2.- 
These questions and answers further explain and clarify provisions in Auditing Standard 
No. 2. In particular, these questions and answers seek to correct the misimpression 
that certain provisions of Auditing Standard No. 2 need to be applied in a rigid manner 
that constrains professional judgment and prevents the conduct of an audit in a manner 
that is both effective and cost-efficient. Second, we are also issuing today this Policy 
Statement, which amplifies some of the themes in those questions and answers and 
articulates our policy with respect to administering Auditing Standard No. 2. 

Failure to apply the concepts discussed in this Policy Statement may reflect poor 
audit planning and result in unnecessary cost. Indeed, although we have not performed 
a detailed analysis, it is sufficiently clear to us that the costs to date associated with the 
implementation of Section 404 have been too high. For the Section 404 process to be 
sustainable, these costs must be reduced in future years. Some of this excess expense 
is attributable to first-year, start-up costs that should not recur in future years; 
nevertheless, we are concerned that auditors may not sufficiently be using several 
features of our standard, described below, that are designed to reduce costs without 
sacrificing quality. 

The Integrated Audit Concept 

As auditing has evolved over the last century from a process of detailed 
examination of individual transactions and account balances into a process of testing 
samples, internal control over financial reporting has emerged as the foundation not 
only of the financial reporting process but also of the financial statement audit. Since 
1941, the SEC's regulations have required auditors to consider a company's internal 
controls in planning an audit.-' In addition, if controls had been adequately designed 
and were operating effectively, then longstanding auditing standards permitted the 



^' The Staff Questions and Answers are available on the Board's Web site, 
at http://www.pcaobus.org/Standards/Staff_Questions_and__Answers/index.asp. 

S' Amendment of Rules 2-02 and 3-07 of Regulation S-X, Accounting Series 
Release No. 21, 11 Fed. Reg. 10921 (Feb. 5, 1941) (amending Regulation S-X to 
provide that "[i]n determining the scope of the audit necessary, appropriate 
consideration shall be given to the adequacy of the system of internal check and 
control. Due weight may be given to an internal system of audit regularly maintained by 
means of auditors employed on the registrant's own staff."). 
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auditor to rely on less costly and time-consuming procedures.- Conversely, if an 
auditor determined that a control was inadequate in its design or operation (or elected 
not to test the control), then the auditor could not rely upon that control.- In this event, 
the auditor would take a considerably more detailed approach by relying almost 
exclusively on detailed tests of account balances and transactions. 

Sections 1 03 and 404 of the Act, and Auditing Standard No. 2, changed that 
audit model. Today, auditors of companies subject to Section 404 must not only obtain 
an understanding of internal control, but they must also examine the design and 
operating effectiveness of internal control sufficient to render an opinion as to that 
effectiveness, as required by Section 103(a)(2)(A)(iii). To reap the most benefit from 
this examination, and to make the overall audit process as efficient as possible, we 
designed in Auditing Standard No. 2 an integrated audit model. 

An integrated audit combines an audit of internal control over financial reporting 
with the audit of the financial statements, such that the objectives of the two audits are 
achieved simultaneously through a single coordinated process. In an integrated audit, 
the auditor's examination of internal control is validated by the findings in the audit of the 
financial statements. In addition, the auditor's findings and conclusions reached during 
the audit of internal control help the auditor better plan and conduct the auditing 
procedures designed to determine whether the financial statements are fairly presented. 
The two processes are mutually reinforcing. In this way, the integrated audit helps to 
improve the quality and integrity of both corporate controls over financial reporting and 
independent financial statement audits. We also believe that an integrated audit is 
more cost-effective than performing two distinct processes to audit internal control and 
the financial statements separately. 

As a practical matter, integration of the two audits means that evidence gathered 
and tests conducted in the context of either audit contribute to completion of both audits. 



^' See AU Section 319.03, Consideration of Internal Control in a Financial 
Statement Audit. Effective April 16, 2003, the PCAOB adopted, on an initial, transitional 
basis, temporary rules that refer to pre-existing professional standards of auditing, 
attestation, quality control, ethics, and independence (the "interim standards"), including 
AU Section 319. These standards are reproduced on our Web site at 
http;//www.pcaobus.org/Standards/lnterim_Standards/index.asp. 

^' See AU Section 319.04, Consideration of Internal Control in a Financial 
Statement Audit. 
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This kind of coordination of work requires an auditor to plan and conduct his or her work 
with both audits in mind. Failing to integrate these audits not only wastes resources, but 
it also jeopardizes the quality of the overall audit and, potentially, misses key insights 
that could identify and uproot a budding accounting or reporting problem.- 

Some auditors have acknowledged that, for a variety of reasons, they did not 
achieve fully integrated audits this year. As a result, audit costs may have been 
substantially higher than necessary. According to a recent survey commissioned by the 
largest U.S. accounting firms, auditors believe that the total costs of compliance with 
Section 404 will decline by 46 percent next year.— Among the factors cited to support 
this prediction was auditors' expectations that integration will be improved.— We, too, 
expect that auditors will better integrate their audits in the coming years. This should 
meaningfully affect both audit costs and audit quality. 

The Importance of Professional Judgment 

Auditing Standard No. 2 is no different from any other auditing standard in that it 
does not prescribe detailed audit programs. For as long as the profession has 
established auditing standards, auditors have used those standards to tailor their own 
audit plans, in a manner that addresses the nature and complexity of the audit client. 

Many participants in the Roundtable, as well as others, have noted, however, 
that some auditors have in fact failed to use tailored audit plans in their first year of 
auditing internal control over financial reporting under Section 404 of the Act and 
Auditing Standard No. 2. Those auditors have instead used a one-size-fits-all audit plan 
driven by standardized checklists that may have little to do with the unique issues and 
risks of the particular client's financial reporting processes. This is a disappointing 
development indicative of poor training and audit planning. Not only do audit fees 



-'' PCAOB Staff Question and Answer No. 50 issued today provides 
additional guidance on integrating the audit of internal control over financial reporting 
with the audit of the financial statements. 

~ See Charles River Associates, Sarbanes-Oxley Section 404 Costs and 
Remediation of Deficiencies: Estimates from a Sample of Fortune 1000 Companies 
(Apr. 2005). 

"' See Letter from Deloitte & Touche, Ernst & Young, KPMG, and 
PricewaterhouseCoopers to Jonathan G. Katz, Secretary, SEC (Apr. 11, 2005). 
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increase when, for example, an audit plan calls for less experienced auditors on the 
engagement team to devote endless hours to process-level control testing, but audit 
quality also decreases, because such a plan contributes little to the search for material 
weaknesses in internal control that could identify a financial reporting problem. 

The overall objective of Auditing Standard No. 2 is for the auditor to obtain 
evidence that a company's control system reasonably assures that its financial 
statements do not contain material misstatements. To accomplish this, the auditor must 
not only exercise judgment to determine how to apply the standard to audit clients in 
different industries and of different sizes, but also exercise judgment to focus their work 
on areas that pose higher risks of misstatement, due either to errors or fraud. Reliance 
on standardized checklists that lead to a focus on controls in low-risk areas obviously 
fails to meet this objective. 

The Top-down Approach and Role of Risk Assessment 

Auditing Standard No. 2 was designed to be applied from the top down. That is, 
the standard focuses the auditor first on company-level controls and then on significant 
accounts, which lead the auditor to significant processes and, finally, individual controls 
at the process, transaction, or application levels. Knowledge obtained at each step 
guides the auditor toward the higher risk areas within the next succeeding level of 
controls. By approaching the task in this way, the auditor is naturally steered toward 
higher risk areas and away from those with less potential to have a material impact on 
the financials. This approach also provides a road map through the control system to 
ensure that the individual controls selected for testing are, in fact, relevant to internal 
control over financial reporting. 

An auditor who chooses another approach needlessly risks adding to the audit's 
cost and reducing its quality. For example, starting at the bottom increases the risk that 
the auditor will become bogged down in testing that may ultimately prove pointless, in 
light of the primary objective of preventing or detecting material misstatements of the 
financial statements, resulting in increased and unnecessary costs. 

A risk-based approach to the auditor's testing strategy can further reduce costs 
while increasing audit effectiveness. The auditor should consider the overall risk related 
to each significant account identified to determine whether he or she should alter the 
nature, timing, and extent of testing of the controls over that specific account. By doing 
so, the auditor will be able to eliminate from further consideration accounts that have 
only a remote likelihood of containing a material misstatement and, in any event, devote 
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less audit attention to areas of low risk. In addition, the auditor should look to the 
individual control being tested and consider the nature, frequency, and importance of 
that specific control in order to determine whether the testing strategy should be revised 
further. 

Finally, the auditor should consider, as part of his or her risk assessment, the 
strength of the company-level controls, to determine whether the result of testing these 
controls will alter the nature, timing, and extent of testing. Although the auditor may not 
rely solely on testing company-level controls,— strong company-level controls should 
lead the auditor to do less work than he or she otherwise would have performed or rely 
to a greater degree on the work of others. 

Using the Work of Others 

An auditor who applies Auditing Standard No. 2 from the top down and 
appropriately assesses risk should naturally identify areas where use of the work of 
others is not only appropriate but is also the most efficient way to perform the audit. 
Redoing work in these areas may unnecessarily increase costs without producing a 
corresponding increase in audit quality. Spending auditor resources in areas in which 
the auditor could rely on the work of others also may cause the auditor to focus too 
much on low-risk controls. As discussed earlier, this could be an early warning sign of 
poor audit planning. 

Auditing Standard No. 2 provides the auditor with considerable flexibility to use 
the work of others, consistent with the profession's longstanding auditing standard on 
using the work of internal auditors in the financial statement audit.- There is some 



- See Auditing Standard No. 2, paragraph 54. PCAOB Staff Questions and 
Answers Nos. 38-43 issued today provide additional guidance on how to plan and 
perform an audit of internal control over financial reporting using both a top-down and a 
risk-based approach. 

12' See AU Section 322, The Auditor's Consideration of tlie Internal Audit 
Function in an Audit of Financial Statements. This standard provides that the work of 
competent and objective internal auditors may affect the nature, timing and extent of the 
audit. Specifically, if internal auditors are competent and objective, then external 
auditors may rely on work performed by internal auditors in the ordinary course of their 
duties. For example, "for certain assertions related to less material financial statement 
amounts where the risk of material misstatement or the degree of subjectivity involved 
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concern that auditors have been reluctant to use Auditing Standard No. 2's flexibility to 
rely on the work of others because the standard also requires the external auditor to 
obtain the principal evidence supporting his or her opinion as to whether internal control 
is effective overall. These provisions are not in conflict. The principal evidence 
provision of Auditing Standard No. 2 requires the auditor to perform sufficient auditing to 
reach his or her own, independent opinion as to the effectiveness of a company's 
internal control over financial reporting. In broad terms, it prevents auditors from merely 
passing on to investors the judgments and opinion of others. 

As one of the questions and answers issued today explains, the principal 
evidence requirement is "primarily qualitative."— Indeed, under Auditing Standard No. 2 
the amount of work necessary to meet the principal evidence test "is not susceptible to 
precise measurement."— 

In practical terms, this means two things. First, the auditor should perform more 
work directly in high-risk areas and seek to use the work of others in areas of lesser 
risk. Second, in evaluating whether the auditor has met the principal evidence test, the 
auditor should ascribe more weight to the work he or she performs in high-risk areas.— 

in the evaluation of the audit evidence is low, the auditor may decide, after considering 
the circumstances and the results of work ... performed by internal auditors ..., that ... 
testing of the assertions directly by the auditor may not be necessary." See id- at 
paragraph 22. In addition, this standard also permits auditors to request direct 
assistance from the internal auditors, such that internal auditors will work under the 
direct supervision of the external auditor. See id. at paragraph 27. PCAOB Staff 
Question and Answer No. 54 issued today provides additional guidance on using the 
work of others. See also PCAOB Staff Question and Answer No. 36 (Nov. 22, 2004) 
(stating that external auditors may "use internal auditors to provide direct assistance in 
the audit of internal control over financial reporting"). 



14/ 
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PCAOB Staff Question and Answer No. 54 (May 16, 2005). 
See Auditing Standard No. 2, note to paragraph 108. 



In other words, principal evidence is not meant to be assessed by simply 
adding up hours or numbers of controls tested in a mechanical fashion; rather, such an 
approach would likely detract from the standard's goal of allowing the auditor to use the 
work of others in an efficient and appropriate manner. 
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In this manner, following the risk-based principles regarding using the work of others 
will, in most circumstances, result in the auditor having obtained the principal evidence 
supporting his or her opinion. 

The Auditor's Ability to Provide Advice to Audit Clients 

Finally, we are concerned about a misconception that, as a result of Auditing 
Standard No. 2, companies may no longer look to their auditors for advice on difficult 
accounting and internal control issues. This misconception appears to manifest itself in 
two particularly problematic ways. First, we have heard at the Roundtable and 
elsewhere that auditors have been unwilling to provide accounting advice to their audit 
clients; second, auditors have apparently encouraged audit clients to finish their 
assessments of internal control and their financial statements before the auditor begins 
audit work to attest to the fairness of those assessments and financial statements. 
Such practices are neither necessary nor advisable. 

Auditing Standard No. 2 provides that an auditor's detection of a material 
misstatement in financial statements is a "strong indicator" of a material weakness in 
internal control. In addition, longstanding rules on auditor independence prohibit the 
auditor from preparing a client's financial statements and from making financial reporting 
decisions on behalf of management.^^ The prospect of PCAOB inspectors examining 
for compliance with these independence rules seems to have led some to conclude that 
management and the auditor should not consult on accounting and internal control 
questions or that the auditor should not review draft financial statements that, because 
they are not finished or complete, may contain misstatements or misapplications of 
Generally Accepted Accounting Principles ("GAAP"). When auditors are unwilling, or 
believe that they are unable, to provide advice on accounting or internal control, 
management may be forced to retain other accounting experts, or to make accounting 
decisions without the benefit of access to the auditor's technical knowledge. 



^ See Rule 2-01(c)(4)(i) of Regulation S-X, 17 G.F.R. § 21 0.2-01 (c)(4)(i) 
(stating that an auditor is not independent of an audit client if it "prepar[es] the audit 
client's financial statements"); Rule 2-01(c)(4)(vi) of Regulation S-X, 17 G.F.R. § 210.2- 
01(c)(4)(vi) (stating that an auditor is not independent of an audit client if it "perform[s] 
any decision-making, supervisory, or ongoing monitoring function for the audit client"); 
see also Meeting of PGAOB Standing Advisory Group, February 16, 2005, available on 
the Board's Web site http://www.pcaobus.org. 
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Nothing in Auditing Standard No. 2 requires this result. Determining when it is 
appropriate for the auditor to provide accounting advice requires professional judgment 
and common sense. Auditors may not, of course, mal<e accounting decisions for their 
clients, and management may not abandon its responsibility for quality financial 
reporting and simply rely on auditors to catch errors. Where management makes its 
own informed decisions regarding how applicable accounting principles apply to its 
company's circumstances, however, the auditor may discuss freely with management 
the meaning and significance of those principles. 

To help dispel confusion on this issue, our staff addressed last June the question 
of whether audit clients may - or should - share draft financial statements with their 
auditors. The answer is decidedly yes. Indeed, information-sharing on a timely basis 
between management and the auditor is necessary. When reviewing draft financial 
statements, in determining the point at which the auditor must draw the line for 
purposes of identifying when a deficiency exists, the auditor should be concerned 
primarily about instances in which the company completed its financial statements and 
disclosures without recognizing a potential material misstatement. If it is clear that all 
applicable controls have not yet operated, then a conclusion as to whether a material 
misstatement in draft financial statements demonstrates a control deficiency would be 
premature." 

Auditors may also provide audit clients technical advice on the proper application 
of GAAP, including offering suggestions for management's consideration to improve 
disclosure and financial statement quality and giving updates on recent developments 
with accounting standards-setters. In addition, management may provide and discuss 
with the auditor preliminary drafts of accounting research memos, spreadsheets, and 
other working papers in order to obtain the auditor's views on the assumptions and 
methods selected by management. Although the auditor may determine that some of 
these communications need to be made in writing, timely and open communication will 
often be best accomplished orally. 

For example, a company that is contemplating a transaction may ask the auditor 
for assistance in determining the proper accounting for the transaction. In this situation. 



18/ 



See PCAOB Staff Question and Answer No. 7 (revised July 27, 2004) 
(explaining that Auditing Standard No. 2 requires an auditor to judge whether, once all 
applicable controls have operated, the company is able to prepare financial statements 
that are free of material misstatements). 
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the auditor may provide substantial help, including explaining how applicable accounting 
principles apply to the transaction, offering sample journal entries, and reviewing 
management's preliminary conclusions. This is very different from a situation in which 
the auditor identifies a potential misapplication of applicable accounting principles in 
connection with a transaction that the auditor learns of outside of the consultation 
process, such as during a quarterly review, or after management has completed its 
financial statements and disclosures, in which case the auditor would have to consider 
whether management's failure to recognize the potential misapplication of applicable 
accounting principles constitutes a significant deficiency or material weakness. 

The Board's Approach to Oversight of Implementation of Auditing Standard No. 2 

We take seriously our responsibility to oversee implementation of Auditing 
Standard No. 2. This includes issuing additional guidance to explain or interpret the 
standard as necessary, as well as supervising auditors' implementation of the standard. 
In particular, we intend to use our upcoming inspections to evaluate how firms have 
conducted the first round of audits under Auditing Standard No. 2. 

Our inspections should drive improvements in the effectiveness and efficiency of 
registered firms' audits of internal control in two ways. First, as we have described 
above. Auditing Standard No. 2 leaves auditors considerable flexibility to apply the 
standard in a manner that is appropriate to each audit. Indeed, the standard requires 
auditors to use professional judgment to tailor their audit plans to the specific risks 
facing each audit client. In our inspections, we will look for audits that suffer from poor 
planning and risk assessment, such as by using standardized checklists without 
appropriately tailoring the procedures to the circumstances or focusing the audit on 
areas that are unlikely to lead to the discovery of material weaknesses in internal control 
at the expense of adequately auditing high-risk areas. When we detect such 
shortcomings, we will demand improvements. 

Second, we have also described above, as well as in the staff questions and 
answers issued today and in the past, several approaches to the audit of internal control 
that we believe improve both the effectiveness and the efficiency of these audits. When 
we review audits that do not apply the approaches described above, we will expect 
auditors to justilv their decisions and to be able to explain how the audit plan 
nevertheless met the objectives of the standard. 

At the Roundtable, a number of the participants focused on the role our 
inspections will p lay in shaping implementation of Auditing Standard No. 2. Some 
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suggested that our inspections should require auditors to reduce costs overall. Others 
suggested that, if our inspections are narrowly focused on technical compliance, they 
could have the perverse effect of promoting a checklist mentality and discouraging the 
use of judgment and tailored audit planning. 

We intend for our inspections to do neither. By focusing on the conduct of a 
high-quality audit as described above, we believe our inspections will promote efficiency 
without the need for us to get involved in auditors' billing practices. And, by focusing on 
appropriate use of judgment and risk assessment, we are deliberately planning our 
inspections in a manner that promotes an audit of internal control that is both thoughtful 
and risk-focused. In other words, we do not intend to second-guess good faith audit 
judgments. If we believe, however, that an auditor has approached the audit in a way 
that is mechanistic and does not reflect the application of professional judgment to the 
specific risks associated with the audit client's financial reporting system, we will not 
hesitate to demand changes to the auditor's approach to implementing Auditing 
Standard No. 2. 

Conclusion 

The first year's implementation of Section 404 required a tremendous effort on 
the part of management and auditors, as well as the commitment of substantial 
corporate resources. The lessons learned so far - and to be learned as we complete 
our first cycle of inspections of audits under Auditing Standard No. 2 - should provide a 
solid basis for substantial improvement in the process, including significant cost 
reduction in the future. 



